1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright (C) 2017 Oracle. All Rights Reserved.
4 * Author: Darrick J. Wong <darrick.wong@oracle.com>
8 #include "xfs_shared.h"
9 #include "xfs_format.h"
10 #include "xfs_trans_resv.h"
11 #include "xfs_mount.h"
12 #include "xfs_log_format.h"
13 #include "xfs_inode.h"
14 #include "xfs_icache.h"
16 #include "xfs_dir2_priv.h"
17 #include "scrub/scrub.h"
18 #include "scrub/common.h"
20 /* Set us up to scrub parents. */
25 return xchk_setup_inode_contents(sc, 0);
30 /* Look for an entry in a parent pointing to this inode. */
32 struct xchk_parent_ctx {
33 struct dir_context dc;
40 /* Look for a single entry in a directory pointing to an inode. */
43 struct dir_context *dc,
50 struct xchk_parent_ctx *spc;
53 spc = container_of(dc, struct xchk_parent_ctx, dc);
58 * If we're facing a fatal signal, bail out. Store the cancellation
59 * status separately because the VFS readdir code squashes error codes
60 * into short directory reads.
62 if (xchk_should_terminate(spc->sc, &error))
63 spc->cancelled = true;
68 /* Count the number of dentries in the parent dir that point to this inode. */
70 xchk_parent_count_parent_dentries(
72 struct xfs_inode *parent,
75 struct xchk_parent_ctx spc = {
76 .dc.actor = xchk_parent_actor,
86 * If there are any blocks, read-ahead block 0 as we're almost
87 * certain to have the next operation be a read there. This is
88 * how we guarantee that the parent's extent map has been loaded,
91 lock_mode = xfs_ilock_data_map_shared(parent);
92 if (parent->i_df.if_nextents > 0)
93 error = xfs_dir3_data_readahead(parent, 0, 0);
94 xfs_iunlock(parent, lock_mode);
99 * Iterate the parent dir to confirm that there is
100 * exactly one entry pointing back to the inode being
103 bufsize = (size_t)min_t(loff_t, XFS_READDIR_BUFSIZE,
104 parent->i_disk_size);
107 error = xfs_readdir(sc->tp, parent, &spc.dc, bufsize);
114 if (oldpos == spc.dc.pos)
124 * Given the inode number of the alleged parent of the inode being
125 * scrubbed, try to validate that the parent has exactly one directory
126 * entry pointing back to the inode being scrubbed.
129 xchk_parent_validate(
130 struct xfs_scrub *sc,
134 struct xfs_mount *mp = sc->mp;
135 struct xfs_inode *dp = NULL;
136 xfs_nlink_t expected_nlink;
142 if (sc->sm->sm_flags & XFS_SCRUB_OFLAG_CORRUPT)
145 /* '..' must not point to ourselves. */
146 if (sc->ip->i_ino == dnum) {
147 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
152 * If we're an unlinked directory, the parent /won't/ have a link
153 * to us. Otherwise, it should have one link.
155 expected_nlink = VFS_I(sc->ip)->i_nlink == 0 ? 0 : 1;
158 * Grab this parent inode. We release the inode before we
159 * cancel the scrub transaction. Since we're don't know a
160 * priori that releasing the inode won't trigger eofblocks
161 * cleanup (which allocates what would be a nested transaction)
162 * if the parent pointer erroneously points to a file, we
163 * can't use DONTCACHE here because DONTCACHE inodes can trigger
164 * immediate inactive cleanup of the inode.
166 * If _iget returns -EINVAL or -ENOENT then the parent inode number is
167 * garbage and the directory is corrupt. If the _iget returns
168 * -EFSCORRUPTED or -EFSBADCRC then the parent is corrupt which is a
169 * cross referencing error. Any other error is an operational error.
171 error = xfs_iget(mp, sc->tp, dnum, XFS_IGET_UNTRUSTED, 0, &dp);
172 if (error == -EINVAL || error == -ENOENT) {
173 error = -EFSCORRUPTED;
174 xchk_fblock_process_error(sc, XFS_DATA_FORK, 0, &error);
177 if (!xchk_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
179 if (dp == sc->ip || !S_ISDIR(VFS_I(dp)->i_mode)) {
180 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
185 * We prefer to keep the inode locked while we lock and search
186 * its alleged parent for a forward reference. If we can grab
187 * the iolock, validate the pointers and we're done. We must
188 * use nowait here to avoid an ABBA deadlock on the parent and
191 if (xfs_ilock_nowait(dp, XFS_IOLOCK_SHARED)) {
192 error = xchk_parent_count_parent_dentries(sc, dp, &nlink);
193 if (!xchk_fblock_xref_process_error(sc, XFS_DATA_FORK, 0,
196 if (nlink != expected_nlink)
197 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
202 * The game changes if we get here. We failed to lock the parent,
203 * so we're going to try to verify both pointers while only holding
204 * one lock so as to avoid deadlocking with something that's actually
205 * trying to traverse down the directory tree.
207 xfs_iunlock(sc->ip, sc->ilock_flags);
209 error = xchk_ilock_inverted(dp, XFS_IOLOCK_SHARED);
213 /* Go looking for our dentry. */
214 error = xchk_parent_count_parent_dentries(sc, dp, &nlink);
215 if (!xchk_fblock_xref_process_error(sc, XFS_DATA_FORK, 0, &error))
218 /* Drop the parent lock, relock this inode. */
219 xfs_iunlock(dp, XFS_IOLOCK_SHARED);
220 error = xchk_ilock_inverted(sc->ip, XFS_IOLOCK_EXCL);
223 sc->ilock_flags = XFS_IOLOCK_EXCL;
226 * If we're an unlinked directory, the parent /won't/ have a link
227 * to us. Otherwise, it should have one link. We have to re-set
228 * it here because we dropped the lock on sc->ip.
230 expected_nlink = VFS_I(sc->ip)->i_nlink == 0 ? 0 : 1;
232 /* Look up '..' to see if the inode changed. */
233 error = xfs_dir_lookup(sc->tp, sc->ip, &xfs_name_dotdot, &dnum, NULL);
234 if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, 0, &error))
237 /* Drat, parent changed. Try again! */
238 if (dnum != dp->i_ino) {
246 * '..' didn't change, so check that there was only one entry
247 * for us in the parent.
249 if (nlink != expected_nlink)
250 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
254 xfs_iunlock(dp, XFS_IOLOCK_SHARED);
261 /* Scrub a parent pointer. */
264 struct xfs_scrub *sc)
266 struct xfs_mount *mp = sc->mp;
273 * If we're a directory, check that the '..' link points up to
274 * a directory that has one entry pointing to us.
276 if (!S_ISDIR(VFS_I(sc->ip)->i_mode))
279 /* We're not a special inode, are we? */
280 if (!xfs_verify_dir_ino(mp, sc->ip->i_ino)) {
281 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
286 * The VFS grabs a read or write lock via i_rwsem before it reads
287 * or writes to a directory. If we've gotten this far we've
288 * already obtained IOLOCK_EXCL, which (since 4.10) is the same as
289 * getting a write lock on i_rwsem. Therefore, it is safe for us
290 * to drop the ILOCK here in order to do directory lookups.
292 sc->ilock_flags &= ~(XFS_ILOCK_EXCL | XFS_MMAPLOCK_EXCL);
293 xfs_iunlock(sc->ip, XFS_ILOCK_EXCL | XFS_MMAPLOCK_EXCL);
296 error = xfs_dir_lookup(sc->tp, sc->ip, &xfs_name_dotdot, &dnum, NULL);
297 if (!xchk_fblock_process_error(sc, XFS_DATA_FORK, 0, &error))
299 if (!xfs_verify_dir_ino(mp, dnum)) {
300 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
304 /* Is this the root dir? Then '..' must point to itself. */
305 if (sc->ip == mp->m_rootip) {
306 if (sc->ip->i_ino != mp->m_sb.sb_rootino ||
307 sc->ip->i_ino != dnum)
308 xchk_fblock_set_corrupt(sc, XFS_DATA_FORK, 0);
313 error = xchk_parent_validate(sc, dnum, &try_again);
316 } while (try_again && ++tries < 20);
319 * We gave it our best shot but failed, so mark this scrub
320 * incomplete. Userspace can decide if it wants to try again.
322 if (try_again && tries == 20)
323 xchk_set_incomplete(sc);
326 * If we failed to lock the parent inode even after a retry, just mark
327 * this scrub incomplete and return.
329 if ((sc->flags & XCHK_TRY_HARDER) && error == -EDEADLOCK) {
331 xchk_set_incomplete(sc);